Elaborate schemes have been devised to maintain security during interactive sessions between an end-user and a computer. Previously, a simple requirement for a single password sufficed, but malicious intrusions, by parties sometimes referred to as “hackers”, resumed after such hackers were able to develop methods to bypass simple password requirements. End-users are now typically advised, and sometimes even required, to compose personal passwords of a random or semi-random nature, such as having at least one capital letter and one lower-case letter, at least one numeral, and a special character (e.g., “!”, “@”, “$”, and “#”). End-users are often asked to change their passwords occasionally, for example, every three months.
Intruders have found ways to by-pass passwords, even those of a random nature, so other protections schemes have been developed, such as those requiring biometric data. One example of such scheme employs a fingerprint reader, so an end-user desiring to conduct an interactive session must supply the fingerprint that is associated with a particular account. However, even biometric data can be stolen and then used to gain unauthorized access to protected data.
Another growing problem is the use of bots (computer programs that run automatically) to bypass user authentication schemes. There is a need for a way to distinguish between bots and humans attempting to begin an interactive session with a computer.
Another method to confirm user identity is to implement transparent continuous authentication (TCA). TCA operates continuously during the whole user session in order to authenticate users according to their behavior or biometric behavior, for example, according to voice. This type of TCA may monitor a speaker's voice during an entire conversation with a call center.
The problem with conventional TCA is that the learning and detecting process for user confirmation is very long. Unlike requesting a password and waiting for a user response, TCA does not have standard requests that produce expected responses from authorized users and unexpected responses from unauthorized users. By not prompting particular responses, the validation method necessarily must take longer due to the need to wait for distinguishable behavior from users for confirmation.
Two common categories of solutions became known as “log-in authentication” and “continuous authentication,” the former being more common.
Log-in authentication involves the transfer of “secrets” during an interactive process, such as, login-in, using USB encryption keys, and biometric authentication (fingerprint, voice, pictures, and even keystrokes and mouse dynamics). This type of authentication could be defeated by unauthorized acquisition of the secrets, such as by phishing or planning Trojan horses.
Continuous authentication, also known as “transparent continuous authentication” (TCA) involves the collecting of information in the background throughout a user session, and this form of authentication could detect an unauthorized user after his/her credentials were already stolen. Applying this transparent method, a user would not be aware that his actions are being scrutinized (unlike the awareness, for example, of being asked to provide a password). Examples of TCA include voice recognition, mouse dynamic recognition, and keystroke analysis. The drawback of this method is that the transparent process is by definition not an interactive process, so by not “involving” the user the authentication process last longer. Thus, the user had more freedom to conduct various activities before the authentication was complete. From the perspective of the protection provides, the session is considered pseudo-random, uncontrolled, unsupervised, and unpredictable.